Reland "Add bailout for large objects when allocating arrays in optimized code."

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 33c90c238775fcffff7bc242fd0e5d51a4bd2e2e..1268927252bb618c74e5466d1754e8b91bcaa201 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -3514,6 +3514,11 @@ HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
   HValue* elements_size =
       builder()->BuildCalculateElementsSize(kind_, capacity);
 
+  // Bail out for large objects.
+  HValue* max_regular_heap_object_size =
+      builder()->Add<HConstant>(Page::kMaxRegularHeapObjectSize);
+  builder()->Add<HBoundsCheck>(elements_size, max_regular_heap_object_size);
+
   // Allocate (dealing with failure appropriately)
   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);